CVE-2026-114741: WP VR 9.0.0 - 9.0.2 - Contributor+ Arbitrary Tour Update and Disclosure via IDOR

Q: Who can exploit this issue?

An authenticated user with contributor-level access or higher can exploit it. The issue affects access to virtual tours created by other users.

Q: What actions can an attacker perform?

A qualifying user can read virtual tours belonging to other users and modify those tours. The vulnerability is caused by missing object-level authorization checks for tour reads and updates.

Q: Which plugin versions are affected?

WPVR versions 9.0.0 through 9.0.2 are affected. The description states that versions before 9.0.3 lack the required authorization checks.

Published Oct 25, 2026

Updated

The WPVR WordPress plugin before 9.0.3 does not perform object-level authorization checks when reading and updating virtual tours, allowing users with contributor-level access and above to read and modify tours created by other users.

Affected Software

1 affected component

WPVR WPVR WordPress plugin<9.0.3

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade WPVR WordPress plugin to a version that resolves this vulnerability.
Fixed in 9.0.3

Event History

Oct 25, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Frequently Asked Questions

Who can exploit this issue?

An authenticated user with contributor-level access or higher can exploit it. The issue affects access to virtual tours created by other users.

What actions can an attacker perform?

A qualifying user can read virtual tours belonging to other users and modify those tours. The vulnerability is caused by missing object-level authorization checks for tour reads and updates.

Which plugin versions are affected?

WPVR versions 9.0.0 through 9.0.2 are affected. The description states that versions before 9.0.3 lack the required authorization checks.

CVE-2026-114741: WP VR 9.0.0 - 9.0.2 - Contributor+ Arbitrary Tour Update and Disclosure via IDOR

Affected Software

Remediation

Event History

Frequently Asked Questions

Who can exploit this issue?

What actions can an attacker perform?

Which plugin versions are affected?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What actions can an attacker perform?

Which plugin versions are affected?